Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

This is a family of multi-partite 3067>EXE infectors. Upon executing an infected file the first to be attacked is the hard disk 3071,"">MBR. Its contents are moved to side 0, cylinder 0, sector 2 by the virus in case that there is only one logical disk. If there are more logical disks the 3071,"">MBR contents are moved to the first extended partition and the virus encrypts the data. It means that when the virus is removed unprofessionally, or when system is loaded from a clean system diskette, the computer knows only about the first logical disk. After the 3071,"">MBR was infected the file with the virus is disinfected. Some time after the infection the virus starts to replicate by infecting 3067,"">EXE files on floppy diskettes. After the infection the virus changes the value of seconds at the time of the last modification to 54. The virus contains coded Russian texts and sometimes it plays music.